Email: 605381 Autolearn: 0 AvgScore: 1.34 AvgScanTime: 2.02 sec Spam: 110693 Autolearn: 0 AvgScore: 13.00 AvgScanTime: 2.76 sec Ham: 494688 Autolearn: 0 AvgScore: -1.27 AvgScanTime: 1.85 sec Time Spent Running SA: 339.52 hours Time Spent Processing Spam: 85.01 hours Time Spent Processing Ham: 254.51 hours TOP SPAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 101188 87.43 91.41 86.54 2 DCC_CHECK 87094 47.89 78.68 41.00 3 DKIM_SIGNED 81503 74.33 73.63 74.49 4 XM_DK_Pass 78648 72.91 71.05 73.33 5 XM_B_Unicode 76939 67.41 69.51 66.94 6 DKIM_VALID 73547 69.12 66.44 69.71 7 XMListUnsubscribeExists 67085 51.68 60.60 49.68 8 DKIM_VALID_AU 55101 52.95 49.78 53.66 9 BAYES_50 49444 52.75 44.67 54.56 10 XM_B_Unicode3 47996 39.67 43.36 38.84 11 MIME_HTML_ONLY 45131 23.78 40.77 19.98 12 XM_DK_Undo_02 37990 11.40 34.32 6.27 13 HTML_FONT_LOW_CONTRAST 35262 28.16 31.86 27.34 14 LOC_TINY_FONT_1 31669 24.30 28.61 23.33 15 BAYES_99 28723 7.57 25.95 3.46 16 XMSubLong 28117 21.37 25.40 20.47 17 DKIM_VALID_EF 26187 26.38 23.66 26.99 18 FVGT_m_MULTI_ODD 25944 21.27 23.44 20.78 19 MultiRelay 24610 19.17 22.23 18.48 20 RELAYCOUNTRY_META 24320 8.14 21.97 5.05 21 FSL_BULK_SIG 23425 9.17 21.16 6.48 22 BOTNET 22946 5.41 20.73 1.98 23 XM_UncommonTLD01 22339 6.96 20.18 4.00 24 TR_DCC_Bayes_99 22097 5.05 19.96 1.71 25 BAYES_999 22014 6.01 19.89 2.90 26 XM_Body_Dirty_Words 21514 14.68 19.44 13.62 27 DCC_CHECK_NEGATIVE 21159 50.11 19.12 57.05 28 T_TM2_M_HEADER_IN_MSG 20178 28.02 18.23 30.21 29 T_KAM_HTML_FONT_INVALID 19913 17.20 17.99 17.03 30 XM_B_Unsub 19057 11.91 17.22 10.72 31 BOTNET_IPINHOSTNAME 18911 6.62 17.08 4.27 32 XM_Multi_Part_URI 17899 13.00 16.17 12.29 33 HTML_IMAGE_RATIO_02 15814 9.36 14.29 8.25 34 LOTS_OF_MONEY 15686 11.95 14.17 11.45 35 UNTRUSTED_Relay 15444 3.78 13.95 1.50 36 XM_Evil_Numbers_Gen 13185 9.35 11.91 8.77 37 RCVD_IN_MSPIKE_H2 12644 12.08 11.42 12.23 38 XMSexyCombo_05 12042 5.35 10.88 4.11 39 SpammyFromTLD_02 11078 2.04 10.01 0.26 40 KHOP_HELO_FCRDNS 10145 3.15 9.16 1.81 41 T_REMOTE_IMAGE 9939 5.10 8.98 4.24 42 XM_H_Long_From01 9854 6.15 8.90 5.53 43 HTML_MIME_NO_HTML_TAG 9700 3.49 8.76 2.30 44 XM_UB50 9654 2.23 8.72 0.77 45 XMNumbers 9435 4.18 8.52 3.21 46 HTML_SHORT_LINK_IMG_1 9033 1.52 8.16 0.03 47 BAYES_80 8925 3.35 8.06 2.30 48 XMSubMetaSx_00 8459 4.83 7.64 4.20 49 XM_B_Phish_Phrases 8327 6.94 7.52 6.82 50 MPART_ALT_DIFF 8187 4.92 7.40 4.37 51 DKIM_INVALID 7956 5.21 7.19 4.77 52 LotsOfNums_01 7841 7.34 7.08 7.40 53 MIME_HEADER_CTYPE_ONLY 7575 1.42 6.84 0.20 54 XM_DIRTYINTL 7529 3.28 6.80 2.49 55 HDRS_LCASE_IMGONLY 7499 1.25 6.77 0.02 56 HTML_IMAGE_RATIO_04 7478 5.65 6.76 5.40 57 XMStrtUSub 7349 5.02 6.64 4.66 58 RCVD_IN_BL_SPAMCOP_NET 7076 1.85 6.39 0.84 59 BAYES_60 6981 4.88 6.31 4.56 60 XM_SendGrid 6548 6.01 5.92 6.03 61 XM_SPF_SoftFail 6467 2.57 5.84 1.84 62 TooManyTo_001 6381 8.30 5.76 8.87 63 REPLYTO_WITHOUT_TO_CC 5707 0.98 5.16 0.05 64 HTML_IMAGE_ONLY_08 5571 1.02 5.03 0.13 65 MIME_HTML_MOSTLY 5484 3.05 4.95 2.63 66 BAYES_95 5232 2.01 4.73 1.40 67 RDNS_DYNAMIC 5042 1.09 4.55 0.31 68 TO_EQ_FM_DOM_HTML_IMG 5023 0.84 4.54 0.01 69 FROM_SUSPICIOUS_NTLD 4736 0.84 4.28 0.08 70 MultiRelay_CC 4722 0.92 4.27 0.17 71 MultiRelay_Combo 4722 0.92 4.27 0.17 72 FROM_SUSPICIOUS_NTLD_FP 4676 0.83 4.22 0.07 73 RELAYCOUNTRY_CA 4545 2.02 4.11 1.55 74 XM_URI_RBL 4530 0.97 4.09 0.27 75 FROM_EXCESS_BASE64 4478 3.28 4.05 3.11 76 RCVD_IN_MSPIKE_H3 4412 8.30 3.99 9.27 77 MIME_QP_LONG_LINE 4412 4.88 3.99 5.08 78 RCVD_IN_MSPIKE_WL 4412 8.30 3.99 9.27 79 TM2_M_URI_OPT_OUT 4316 2.22 3.90 1.85 80 RCVD_IN_RP_RNBL 4295 0.79 3.88 0.09 81 BAYES_40 4238 5.65 3.83 6.05 82 DKIM_ADSP_NXDOMAIN 4226 1.40 3.82 0.86 83 HTML_IMAGE_RATIO_06 4149 3.73 3.75 3.73 84 TR_Mismatch_TLD_02 4114 0.73 3.72 0.06 85 T_XMDrugObfuBody_08 4016 1.95 3.63 1.57 86 MIME_HTML_ONLY_MULTI 3898 2.78 3.52 2.61 87 XM_OfRef6 3861 1.81 3.49 1.43 88 XM_CamelCaseFrm001 3851 2.52 3.48 2.30 89 SpammyFromTLD_01 3820 1.42 3.45 0.96 90 BODY_URI_ONLY 3433 0.63 3.10 0.07 91 HDRS_MISSP 3418 0.57 3.09 0.00 92 TR_XM_PHPDW 3361 1.22 3.04 0.81 93 T_TooManySym_01 3323 4.21 3.00 4.47 94 TR_XM_PHPForged 3285 1.18 2.97 0.78 95 XM_B_SpammyTLD 3264 2.03 2.95 1.83 96 TR_XM_FormFill2 3259 1.18 2.94 0.78 97 TR_XM_DK_SendGrid 3259 3.26 2.94 3.33 98 BAYES_20 3257 4.50 2.94 4.85 99 XM_H_PHPOS 3255 1.17 2.94 0.78 100 BODY_SINGLE_WORD 3240 0.54 2.93 0.01 101 BODY_SINGLE_URI 3238 0.54 2.93 0.00 102 URI_HEX 3193 1.49 2.88 1.18 103 XMSexyCombo_01 3192 1.39 2.88 1.05 104 HTML_IMAGE_ONLY_12 3178 0.66 2.87 0.17 105 SHORT_IMG_SUSP_NTLD 3129 0.52 2.83 0.00 106 XM_B_Unsub2 3094 3.07 2.80 3.13 107 XMDiploma_00 3055 1.76 2.76 1.54 108 SUBJECT_NEEDS_ENCODING 2971 0.54 2.68 0.05 109 SUBJ_ILLEGAL_CHARS 2964 0.53 2.68 0.05 110 URI_NOVOWEL 2950 0.75 2.67 0.32 111 TR_XM_RelayPhish 2830 1.45 2.56 1.20 112 RCVD_IN_MSPIKE_BL 2811 1.46 2.54 1.22 113 RELAYCOUNTRY_GB 2799 1.31 2.53 1.04 114 NO_DNS_FOR_FROM 2642 1.74 2.39 1.60 115 RELAYCOUNTRY_FR 2632 0.69 2.38 0.31 116 XMStockSpam_06 2614 1.24 2.36 0.99 117 SUBJ_ALL_CAPS 2587 1.57 2.34 1.40 118 ALL_TRUSTED 2559 13.65 2.31 16.19 119 RELAYCOUNTRY_DE 2528 0.75 2.28 0.41 120 TR_XM_INV_DKIM 2521 0.50 2.28 0.11 121 HTML_IMAGE_RATIO_08 2491 2.58 2.25 2.65 122 DATE_IN_PAST_03_06 2457 0.49 2.22 0.10 123 BOTNET_NORDNS 2435 0.45 2.20 0.06 124 XM_H_Long_From02 2434 1.26 2.20 1.05 125 FROM_NTLD_LINKBAIT 2372 0.39 2.14 0.00 126 XMBody_17 2370 1.10 2.14 0.86 127 RCVD_IN_RP_SAFE 2328 8.04 2.10 9.36 128 TM2_M_VERY_LONG_WORD 2275 1.47 2.06 1.34 129 DIET_1 2245 0.81 2.03 0.54 130 PDS_OTHER_BAD_TLD 2238 0.77 2.02 0.49 131 RCVD_IN_IADB_LISTED 2134 4.06 1.93 4.53 132 TR_LOTS_OF_MONEY2 2086 0.91 1.88 0.70 133 T_MONEY_PERCENT 2086 0.91 1.88 0.70 134 BAYES_00 2078 16.30 1.88 19.53 135 XMGenDplmaNmb 2034 1.19 1.84 1.05 136 RCVD_IN_IADB_SPF 2006 3.53 1.81 3.91 137 RCVD_IN_PSBL 2003 0.33 1.81 0.00 138 XM_BadFromFormat 1997 0.41 1.80 0.10 139 RELAYCOUNTRY_IN 1986 0.46 1.79 0.16 140 URI_TRY_3LD 1977 1.36 1.79 1.27 141 RCVD_IN_IADB_SENDERID 1977 3.12 1.79 3.42 142 RCVD_IN_IADB_DK 1974 3.08 1.78 3.37 143 RCVD_IN_MSPIKE_L3 1970 0.96 1.78 0.78 144 RCVD_IN_RP_CERTIFIED 1965 7.21 1.78 8.42 145 TR_Mismatch_TLD_01 1953 0.53 1.76 0.25 146 T_XMHurry_00 1906 0.95 1.72 0.78 147 DKIM_ADSP_CUSTOM_MED 1891 1.14 1.71 1.01 148 XMPhish11 1855 1.30 1.68 1.22 149 URIBL_SBL_A 1812 0.54 1.64 0.29 150 HTML_TAG_BALANCE_CENTER 1810 0.37 1.64 0.09 151 HK_RANDOM_REPLYTO 1756 0.53 1.59 0.29 152 FORGED_GMAIL_RCVD 1748 0.73 1.58 0.54 153 XMSubMetaI_00 1727 0.83 1.56 0.66 154 NML_ADSP_CUSTOM_MED 1710 0.87 1.54 0.72 155 NO_FM_NAME_IP_HOSTN 1703 0.28 1.54 0.00 156 TR_LOTS_OF_MONEY3 1695 0.72 1.53 0.53 157 T_XMDrugObfuBody_14 1669 1.60 1.51 1.62 158 TR_Symld_Words 1663 1.33 1.50 1.29 159 XMSexyCombo_04 1656 0.64 1.50 0.45 160 XMHTML_After_End 1612 1.13 1.46 1.06 161 XM_ProductURIs 1583 0.95 1.43 0.84 162 XMSubMetaSxObfu_03 1579 0.86 1.43 0.73 163 MAILING_LIST_MULTI 1540 1.97 1.39 2.10 164 URIBL_DBL_ABUSE_REDIR 1532 0.26 1.38 0.01 165 XM_UB60 1499 0.30 1.35 0.06 166 BAYES_05 1489 2.69 1.35 2.99 167 XMSlimDrugH 1486 0.50 1.34 0.31 168 FILL_THIS_FORM 1477 0.85 1.33 0.75 169 TR_XM_DK_Bayes 1454 11.99 1.31 14.38 170 T_XMDrugObfuBody_00 1445 0.79 1.31 0.68 171 XM_H_PHPMailer 1412 0.69 1.28 0.56 172 FILL_THIS_FORM_LONG 1412 0.70 1.28 0.57 173 HK_SCAM 1360 0.25 1.23 0.03 174 XMSubPhish11 1342 0.32 1.21 0.12 175 XMBdyGiftCard01 1318 0.92 1.19 0.86 176 T_FILL_THIS_FORM_SHORT 1280 1.19 1.16 1.20 177 RELAYCOUNTRY_RU 1273 0.23 1.15 0.02 178 REMOVE_BEFORE_LINK 1272 0.56 1.15 0.43 179 TR_XM_DK_Bayes1 1260 11.42 1.14 13.72 180 XM_H_Undi_Recip 1251 0.41 1.13 0.25 181 HK_RANDOM_FROM 1235 0.30 1.12 0.12 182 XM_H_PHPOS_M 1185 0.34 1.07 0.18 183 XM_UB99 1145 0.19 1.03 0.00 184 UNPARSEABLE_RELAY 1140 1.80 1.03 1.97 185 FVGT_m_MULTI_ODD_EMAIL 1140 0.21 1.03 0.02 186 XMBrknScrpt_02 1123 0.92 1.01 0.90 187 TR_XM_DK_Bayes2 1120 10.23 1.01 12.30 188 TR_XM_Undi_Recip5 1111 0.20 1.00 0.01 189 FROM_DOMAIN_NOVOWEL 1098 0.21 0.99 0.04 190 MONEY_FORM 1088 0.19 0.98 0.01 191 XMPhish30 1061 0.54 0.96 0.45 192 LongTLD 1055 0.35 0.95 0.21 193 XM_DK_Undo_01 1034 1.48 0.93 1.60 194 XMPhish14 1025 0.60 0.93 0.52 195 TR_MetaPhish_Combo_01 1024 0.91 0.93 0.91 196 HTML_FONT_SIZE_LARGE 1021 0.27 0.92 0.13 197 XMSubMetaSSx_00 1019 0.29 0.92 0.15 198 XM_SPF_Unknown 1016 0.76 0.92 0.73 199 HTML_EXTRA_CLOSE 1007 0.18 0.91 0.02 200 URG_BIZ 989 0.23 0.89 0.09 ---------------------------------------------------------------------- TOP HAM RULES FIRED ---------------------------------------------------------------------- RANK RULE NAME COUNT %OFMAIL %OFSPAM %OFHAM ---------------------------------------------------------------------- 1 HTML_MESSAGE 428097 87.43 91.41 86.54 2 DKIM_SIGNED 368484 74.33 73.63 74.49 3 XM_DK_Pass 362761 72.91 71.05 73.33 4 DKIM_VALID 344870 69.12 66.44 69.71 5 XM_B_Unicode 331155 67.41 69.51 66.94 6 DCC_CHECK_NEGATIVE 282214 50.11 19.12 57.05 7 BAYES_50 269881 52.75 44.67 54.56 8 DKIM_VALID_AU 265428 52.95 49.78 53.66 9 XMListUnsubscribeExists 245761 51.68 60.60 49.68 10 DCC_CHECK 202811 47.89 78.68 41.00 11 XM_B_Unicode3 192155 39.67 43.36 38.84 12 T_TM2_M_HEADER_IN_MSG 149422 28.02 18.23 30.21 13 HTML_FONT_LOW_CONTRAST 135238 28.16 31.86 27.34 14 DKIM_VALID_EF 133507 26.38 23.66 26.99 15 LOC_TINY_FONT_1 115433 24.30 28.61 23.33 16 FVGT_m_MULTI_ODD 102802 21.27 23.44 20.78 17 XMSubLong 101245 21.37 25.40 20.47 18 MIME_HTML_ONLY 98834 23.78 40.77 19.98 19 BAYES_00 96618 16.30 1.88 19.53 20 MultiRelay 91416 19.17 22.23 18.48 21 T_KAM_HTML_FONT_INVALID 84230 17.20 17.99 17.03 22 ALL_TRUSTED 80083 13.65 2.31 16.19 23 TR_XM_DK_Bayes 71132 11.99 1.31 14.38 24 TR_XM_DK_Bayes1 67870 11.42 1.14 13.72 25 XM_Body_Dirty_Words 67359 14.68 19.44 13.62 26 TR_XM_DK_Bayes2 60828 10.23 1.01 12.30 27 XM_Multi_Part_URI 60776 13.00 16.17 12.29 28 RCVD_IN_MSPIKE_H2 60493 12.08 11.42 12.23 29 LOTS_OF_MONEY 56632 11.95 14.17 11.45 30 XM_B_Unsub 53047 11.91 17.22 10.72 31 RCVD_IN_RP_SAFE 46325 8.04 2.10 9.36 32 RCVD_IN_MSPIKE_WL 45851 8.30 3.99 9.27 33 RCVD_IN_MSPIKE_H3 45851 8.30 3.99 9.27 34 TooManyTo_001 43887 8.30 5.76 8.87 35 XM_Evil_Numbers_Gen 43404 9.35 11.91 8.77 36 RCVD_IN_RP_CERTIFIED 41674 7.21 1.78 8.42 37 HTML_IMAGE_RATIO_02 40835 9.36 14.29 8.25 38 LotsOfNums_01 36593 7.34 7.08 7.40 39 XM_DKIMWhitelistDomains 34611 5.80 0.47 7.00 40 XM_B_Phish_Phrases 33713 6.94 7.52 6.82 41 FSL_BULK_SIG 32071 9.17 21.16 6.48 42 XM_DK_Undo_02 31014 11.40 34.32 6.27 43 BAYES_40 29945 5.65 3.83 6.05 44 XM_SendGrid 29834 6.01 5.92 6.03 45 XM_H_Long_From01 27380 6.15 8.90 5.53 46 HTML_IMAGE_RATIO_04 26704 5.65 6.76 5.40 47 MIME_QP_LONG_LINE 25116 4.88 3.99 5.08 48 RELAYCOUNTRY_META 24981 8.14 21.97 5.05 49 XM_PDF 24114 4.12 0.75 4.87 50 BAYES_20 23978 4.50 2.94 4.85 51 DKIM_INVALID 23614 5.21 7.19 4.77 52 XMStrtUSub 23044 5.02 6.64 4.66 53 BAYES_60 22541 4.88 6.31 4.56 54 RCVD_IN_IADB_LISTED 22426 4.06 1.93 4.53 55 T_TooManySym_01 22135 4.21 3.00 4.47 56 MPART_ALT_DIFF 21623 4.92 7.40 4.37 57 BOTNET_IPINHOSTNAME 21143 6.62 17.08 4.27 58 T_REMOTE_IMAGE 20961 5.10 8.98 4.24 59 XMSubMetaSx_00 20756 4.83 7.64 4.20 60 XMSexyCombo_05 20352 5.35 10.88 4.11 61 XM_UncommonTLD01 19778 6.96 20.18 4.00 62 RCVD_IN_IADB_SPF 19363 3.53 1.81 3.91 63 HTML_IMAGE_RATIO_06 18445 3.73 3.75 3.73 64 IN_ZIMBRA_NJ_WHITELIST 17126 2.83 0.01 3.46 65 BAYES_99 17120 7.57 25.95 3.46 66 RCVD_IN_IADB_SENDERID 16933 3.12 1.79 3.42 67 RCVD_IN_IADB_DK 16686 3.08 1.78 3.37 68 TR_XM_DK_SendGrid 16486 3.26 2.94 3.33 69 XMNumbers 15886 4.18 8.52 3.21 70 XM_B_Unsub2 15504 3.07 2.80 3.13 71 FROM_EXCESS_BASE64 15386 3.28 4.05 3.11 72 BAYES_05 14776 2.69 1.35 2.99 73 ANY_BOUNCE_MESSAGE 14420 2.46 0.42 2.91 74 BOUNCE_MESSAGE 14419 2.46 0.41 2.91 75 BAYES_999 14366 6.01 19.89 2.90 76 RCVD_IN_IADB_VOUCHED 14266 2.44 0.47 2.88 77 HTML_IMAGE_RATIO_08 13103 2.58 2.25 2.65 78 MIME_HTML_MOSTLY 12995 3.05 4.95 2.63 79 MIME_HTML_ONLY_MULTI 12925 2.78 3.52 2.61 80 XM_DIRTYINTL 12304 3.28 6.80 2.49 81 HTML_MIME_NO_HTML_TAG 11401 3.49 8.76 2.30 82 XM_CamelCaseFrm001 11396 2.52 3.48 2.30 83 BAYES_80 11382 3.35 8.06 2.30 84 T_TooManySym_02 11345 1.99 0.62 2.29 85 TooManyTo_002 11188 1.99 0.79 2.26 86 MAILING_LIST_MULTI 10398 1.97 1.39 2.10 87 BOTNET 9786 5.41 20.73 1.98 88 UNPARSEABLE_RELAY 9763 1.80 1.03 1.97 89 XM_H_Trusted_IP 9691 1.60 0.00 1.96 90 TM2_M_URI_OPT_OUT 9132 2.22 3.90 1.85 91 RCVD_IN_IADB_OPTIN 9129 1.57 0.33 1.85 92 XM_SPF_SoftFail 9088 2.57 5.84 1.84 93 XM_B_SpammyTLD 9035 2.03 2.95 1.83 94 KHOP_HELO_FCRDNS 8950 3.15 9.16 1.81 95 HELO_NODOT 8873 1.61 0.79 1.79 96 HELO_NO_DOMAIN 8830 1.60 0.79 1.78 97 TR_DCC_Bayes_99 8459 5.05 19.96 1.71 98 TVD_RCVD_IP 8052 1.40 0.38 1.63 99 T_XMDrugObfuBody_14 8018 1.60 1.51 1.62 100 NO_DNS_FOR_FROM 7918 1.74 2.39 1.60 101 XM_DK_Undo_01 7898 1.48 0.93 1.60 102 T_XMDrugObfuBody_08 7766 1.95 3.63 1.57 103 RELAYCOUNTRY_CA 7690 2.02 4.11 1.55 104 INVALID_MSGID 7629 1.30 0.24 1.54 105 XMDiploma_00 7620 1.76 2.76 1.54 106 TooManyTo_003 7495 1.35 0.63 1.52 107 UNTRUSTED_Relay 7437 3.78 13.95 1.50 108 IN_HORDE_ADDRESS_BOOK 7412 1.23 0.04 1.50 109 XMCapTrack 7176 1.25 0.37 1.45 110 XM_OfRef6 7093 1.81 3.49 1.43 111 SUBJ_ALL_CAPS 6937 1.57 2.34 1.40 112 BAYES_95 6914 2.01 4.73 1.40 113 TM2_M_VERY_LONG_WORD 6644 1.47 2.06 1.34 114 TO_MALFORMED 6602 1.21 0.65 1.33 115 TR_Symld_Words 6369 1.33 1.50 1.29 116 URI_TRY_3LD 6263 1.36 1.79 1.27 117 CK_HELO_DYNAMIC_SPLIT_IP 6231 1.05 0.09 1.26 118 HELO_DYNAMIC_IPADDR2 6228 1.04 0.06 1.26 119 XMPhish11 6040 1.30 1.68 1.22 120 RCVD_IN_MSPIKE_BL 6026 1.46 2.54 1.22 121 TR_XM_RelayPhish 5956 1.45 2.56 1.20 122 T_FILL_THIS_FORM_SHORT 5918 1.19 1.16 1.20 123 URI_HEX 5833 1.49 2.88 1.18 124 XM_GoogleGroups 5825 1.04 0.45 1.18 125 USER_IN_DEF_DKIM_WL 5697 0.94 0.02 1.15 126 TooManyTo_004 5490 1.00 0.50 1.11 127 XMHTML_After_End 5222 1.13 1.46 1.06 128 XM_H_Long_From02 5201 1.26 2.20 1.05 129 XMGenDplmaNmb 5199 1.19 1.84 1.05 130 XMSexyCombo_01 5197 1.39 2.88 1.05 131 RELAYCOUNTRY_GB 5135 1.31 2.53 1.04 132 XMSubNoVowel 5003 0.93 0.58 1.01 133 DKIM_ADSP_CUSTOM_MED 4988 1.14 1.71 1.01 134 XMStockSpam_06 4883 1.24 2.36 0.99 135 XMGappySubj_01 4809 0.86 0.34 0.97 136 SpammyFromTLD_01 4767 1.42 3.45 0.96 137 TooManyTo_005 4629 0.84 0.44 0.94 138 TR_MetaPhish_Combo_01 4479 0.91 0.93 0.91 139 XMBrknScrpt_02 4461 0.92 1.01 0.90 140 XMBody_17 4279 1.10 2.14 0.86 141 DKIM_ADSP_NXDOMAIN 4267 1.40 3.82 0.86 142 XMBdyGiftCard01 4266 0.92 1.19 0.86 143 HTML_FONT_FACE_BAD 4163 0.83 0.77 0.84 144 XM_ProductURIs 4156 0.95 1.43 0.84 145 RCVD_IN_BL_SPAMCOP_NET 4131 1.85 6.39 0.84 146 TR_XM_PHPDW 3996 1.22 3.04 0.81 147 TR_XM_PHPForged 3881 1.18 2.97 0.78 148 TR_XM_FormFill2 3874 1.18 2.94 0.78 149 RCVD_IN_MSPIKE_L3 3870 0.96 1.78 0.78 150 T_XMHurry_00 3862 0.95 1.72 0.78 151 XM_H_PHPOS 3838 1.17 2.94 0.78 152 XM_UB50 3826 2.23 8.72 0.77 153 XMBody_95 3748 0.64 0.12 0.76 154 FILL_THIS_FORM 3686 0.85 1.33 0.75 155 XMSubMetaSxObfu_03 3631 0.86 1.43 0.73 156 XM_SPF_Unknown 3605 0.76 0.92 0.73 157 NML_ADSP_CUSTOM_MED 3542 0.87 1.54 0.72 158 HTTPS_HTTP_MISMATCH 3531 0.74 0.84 0.71 159 T_MONEY_PERCENT 3446 0.91 1.88 0.70 160 TR_LOTS_OF_MONEY2 3446 0.91 1.88 0.70 161 T_XMDrugObfuBody_00 3342 0.79 1.31 0.68 162 XM_E_Blogspot 3290 0.56 0.09 0.67 163 XMSubMetaI_00 3273 0.83 1.56 0.66 164 XM_B_REG_HTML 3250 0.59 0.28 0.66 165 AC_FROM_MANY_DOTS 3115 0.52 0.02 0.63 166 T_OBFU_PDF_ATTACH 3036 0.54 0.23 0.61 167 XMNoVowels 2853 0.57 0.55 0.58 168 XM_ShortIntro_01 2847 0.57 0.54 0.58 169 FILL_THIS_FORM_LONG 2838 0.70 1.28 0.57 170 XM_H_PHPMailer 2778 0.69 1.28 0.56 171 XM_RXBody 2734 0.58 0.73 0.55 172 FORGED_GMAIL_RCVD 2672 0.73 1.58 0.54 173 T_FILL_THIS_FORM_LOAN 2670 0.50 0.33 0.54 174 DIET_1 2662 0.81 2.03 0.54 175 TR_LOTS_OF_MONEY3 2641 0.72 1.53 0.53 176 XMPhish14 2597 0.60 0.93 0.52 177 USER_IN_WHITELIST 2577 0.43 0.00 0.52 178 XMMoneyMeta_00 2551 0.57 0.80 0.52 179 TM2_M_BODY_EMPTY 2549 0.44 0.10 0.52 180 AC_DIV_BONANZA 2500 0.43 0.11 0.51 181 XMHTMLBadTable_001 2488 0.53 0.66 0.50 182 HTML_TAG_BALANCE_BODY 2445 0.50 0.54 0.49 183 MISSING_HEADERS 2440 0.52 0.65 0.49 184 FROM_GOV_DKIM_AU 2422 0.44 0.20 0.49 185 SHORT_HELO_AND_INLINE_IMAGE 2417 0.40 0.03 0.49 186 PDS_OTHER_BAD_TLD 2410 0.77 2.02 0.49 187 XMRcvdHeader_15 2408 0.40 0.00 0.49 188 PLING_QUERY 2358 0.52 0.74 0.48 189 T_TooManySym_03 2346 0.43 0.25 0.47 190 XMSolicitRefs_0 2213 0.43 0.34 0.45 191 XMSexyCombo_04 2212 0.64 1.50 0.45 192 HTML_IMAGE_ONLY_20 2212 0.43 0.34 0.45 193 XMPhish30 2202 0.54 0.96 0.45 194 XMBody_78 2183 0.50 0.76 0.44 195 XMLngstWrd_00 2180 0.46 0.52 0.44 196 RELAYCOUNTRY_AU 2176 0.46 0.53 0.44 197 HTML_IMAGE_ONLY_28 2152 0.48 0.69 0.44 198 RCVD_IN_SORBS_DUL 2148 0.40 0.26 0.43 199 REMOVE_BEFORE_LINK 2148 0.56 1.15 0.43 200 FROM_GOV_SPOOF 2136 0.41 0.29 0.43 ----------------------------------------------------------------------